topic Max connection count to API? in Getting Data In

Max connection count to API?

twinspop — Thu, 30 Dec 2010 01:49:54 GMT

I wrote a simple, REST-based proxy to query Splunk's REST API from SiteScope. The proxy manages job creation, tracking etc so that SiteScope can simply issue a GET on a URL and get easily parsable XML in return. I have 25 or so monitors that use it, and they run once per minute.

Very often the proxy gets a 503 server unavailable message from Splunk. Apparently I'm hitting a limit on the API interface? Is there a switch to adjust this?

v4.1.5

EDIT2:

My $SPLUNK_HOME/etc/system/local/authorize.conf file:

[default]
run_web_script_fields = enabled
run_web_script_surrounding_events = enabled

[role_user]
srchJobsQuota = 16

The user I am hitting the API with is in the "user" role.

Re: Max connection count to API?

twinspop — Thu, 30 Dec 2010 07:54:36 GMT

Found this previous question:

http://answers.splunk.com/questions/3442/splunk-appears-to-be-ignoring-limits-conf-base-max-searches-8

Seems to be the answer

Re: Max connection count to API?

twinspop — Thu, 30 Dec 2010 23:44:34 GMT

Nope. Still getting the 503s. 😞

Re: Max connection count to API?

twinspop — Fri, 31 Dec 2010 00:01:35 GMT

More research from the SiteScope end: When I get the error there are at most 2 or 3 other searches running. Doesn't seem like too many.

Re: Max connection count to API?

tradel — Tue, 11 Jan 2011 23:48:41 GMT

Try this in server.conf:

[managementServer]
maxBackLog = 100
requestQueueSize = 100
threadPoolSize = 100